Configuration files break deployments in two ways: they fail to parse, or they parse into something other than what you meant. The second is worse, because it succeeds quietly.
YAML's type coercion traps
YAML 1.1 interprets several unquoted values as types you did not ask for. Every one of these has caused a real production incident:
| You wrote | YAML gives you | Consequence |
|---|---|---|
no | boolean false | The Norway problem — country code NO becomes false |
yes, on, off | booleans | Same class of bug |
08 | error or 8 | Octal parsing; version numbers and zip codes break |
1.20 | float 1.2 | Trailing zero lost from a version string |
1:30 | sexagesimal 90 | Duration strings become integers |
null, ~ | null | An intentional string becomes nothing |
The fix is always the same: quote the value. This validator flags each of these patterns.
Structural errors
Tab indentation. YAML forbids tabs outright, and the resulting error rarely mentions tabs. Editors that insert them silently make this common.
Missing space after a colon. key:value is a single scalar string, not a mapping. It parses successfully and produces a structure nothing expects.
Unquoted values containing : . A colon-space inside a value makes YAML try to parse a nested mapping.
For JSON, the errors are simpler and the parser reports a position, which this tool converts to a line and column. Trailing commas and single-quoted strings — both legal in JavaScript, neither legal in JSON — account for most of them.
Secret hygiene checks
Beyond syntax, any field whose name suggests a credential is checked:
- Empty values. A blank secret often fails open rather than closed.
- Placeholders.
changeme,password,xxxreaching production. - Weak entropy. Under 64 bits in a secret-named field means it was chosen rather than generated.
Required keys
Supply dotted paths — database.password, api.key — and each is reported if absent. This catches the deployment where a new required variable was added to the code but not to the environment, which otherwise fails at the first request that needs it.
Frequently asked questions
Is my config sent anywhere?
No. Validation runs in your browser. Load the page, disconnect, and it still works — which matters when the config contains real values.
Why does my YAML parse differently in different tools?
YAML 1.1 and 1.2 differ, notably on booleans: 1.2 recognises only true/false, while 1.1 also accepts yes/no/on/off. Different libraries implement different versions. Quoting removes the ambiguity entirely.
Should I use JSON or YAML for configuration?
JSON for machine-generated config — it has no ambiguity and no significant whitespace. YAML for human-edited config, where comments and readability matter. Kubernetes accepts both, and JSON is a valid subset of YAML.
Does this validate against a schema?
No. It checks syntax, type traps and secret hygiene. For schema validation use a JSON Schema validator, or kubectl apply --dry-run=server for Kubernetes manifests.